popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

wininit.exe

Generic Malware UPX Malicious Library PNG Format PE File DLL PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 11, 2023, 10:32 p.m. June 11, 2023, 10:34 p.m.
Size 406.8KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 1a3a72cfd544d61a7a9b650477460e89
SHA256 c79eafdedf764d6b8ed3c18e9d1853f881b452e017202ac8eed2828dca2e0450
CRC32 DDDB865F
ssdeep 6144:u6dgNzV+OT7EDnos/MzmtxBKh2ch8ot1oxLg7IboejhiCV0E4rpugBt:8P+OTIPMzmtxBwHPoxk7IfjhiTU6t
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2556
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x732a2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2556
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73924000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 58892288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03600000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nstF1A4.tmp\System.dll
file C:\Users\test22\AppData\Local\Temp\nstF1A4.tmp\System.dll
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Minix.4!c
MicroWorld-eScan Trojan.Generic.33891348
FireEye Trojan.Generic.33891348
McAfee Artemis!1A3A72CFD544
Cylance unsafe
Sangfor Trojan.Win32.Agent.Vd0x
Alibaba Trojan:Win32/Makoob.775c149f
Arcabit Trojan.Generic.D2052414
Cyren W32/ABRisk.KODP-7363
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Generik.DTOWLO
APEX Malicious
Kaspersky HEUR:Trojan.NSIS.Makoob.gen
BitDefender Trojan.Generic.33891348
NANO-Antivirus Trojan.Win32.Minix.jwkvsi
Avast NSIS:DropperX-gen [Drp]
Tencent Win32.Trojan.FalseSign.Bzlw
Emsisoft Trojan.Generic.33891348 (B)
DrWeb Trojan.Packed2.45345
VIPRE Trojan.Generic.33891348
TrendMicro Trojan.Win32.GULOADER.YXDFJZ
McAfee-GW-Edition Artemis!Trojan
Sophos Mal/Generic-S
Webroot W32.Trojan.GenKD
Microsoft Trojan:Win32/Casdet!rfn
ZoneAlarm HEUR:Trojan.NSIS.Makoob.gen
GData Trojan.Generic.33891348
Google Detected
ALYac Trojan.Generic.33891348
MAX malware (ai score=80)
VBA32 TrojanDownloader.Minix
Malwarebytes Trojan.GuLoader
Panda Trj/Chgt.AD
TrendMicro-HouseCall Trojan.Win32.GULOADER.YXDFJZ
Ikarus Trojan.NSIS.Agent
Fortinet W32/PossibleThreat
AVG NSIS:DropperX-gen [Drp]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_90% (W)